ClawHub
Back to skill

Security audit

Monad Development

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent Monad development helper, but it requires agents to persist blockchain private keys in local files or .env storage, which deserves review before install.

Install only if you want an agent to help with Monad deployments and you are comfortable supervising wallet and transaction handling. Use a low-value testnet or dedicated deployment wallet, require confirmation before any mainnet broadcast, avoid storing valuable private keys in plaintext files or project .env files, and review verification payloads before sending contract data to external APIs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs agents to generate and persist wallet private keys without a strong upfront warning about the sensitivity of those credentials or safer alternatives. In an agent context, this increases the chance that secrets are written to insecure locations, logged, or retained longer than necessary, leading to wallet compromise and loss of funds.

Ssd 3

High
Confidence
97% confidence
Finding
The skill explicitly tells the agent to persist private keys and disclose where wallet details are stored, including plaintext-like storage options such as `~/.monad-wallet` or a project `.env` file. In a development-agent environment, this can expose signing credentials to other tools, logs, source control mistakes, or local compromise, enabling unauthorized transactions and irreversible theft of assets.

Session Persistence

Medium
Category
Rogue Agent
Content
**CRITICAL for agents:** If you generate a wallet for the user, you MUST persist it for future use.

When generating a new wallet:
1. Create wallet: `cast wallet new`
2. **Immediately save** the address and private key to a secure location
3. Inform the user where the wallet details are stored
4. Fund the wallet via faucet before deployment
Confidence
94% confidence
Finding
Create wallet: `cast wallet new` 2. **Immediately save** the address and private key to a secure location 3. Inform the user where the wallet details are stored 4. Fund the wallet via faucet before de

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.